An organization has implemented a new automated payroll system that contains a table of pay rates that are matched to employee job classifications. Which control should an internal auditor suggest in order to ensure that the table is updated correctly, and is used only for valid pay changes?

This option describes the implementation of a critical internal control: segregation of duties (SoD). By requiring an independent manager, who does not have the system permissions to change the pay rate table, to formally authorize any modifications, the organization creates a powerful preventive control. This process ensures that all changes are reviewed for legitimacy and accuracy by an appropriate authority before they are entered into the system by a different individual. This separation of authorization from data modification is a fundamental principle for maintaining the integrity of critical master data, such as a payroll table.

A. Restricting access from authorized managers is counterproductive. Their review and approval are necessary; the key is separating their authorization role from the data entry role.
B. This option violates segregation of duties. Allowing the person who can change the table to also be the one who verifies the authorization creates a significant risk of unauthorized changes.
C. Edit and reasonableness checks are valuable for preventing data entry errors but do not verify that a change was properly authorized in the first place.

1. COSO, Internal Control – Integrated Framework: Principles (May 2013). Principle 10, "Selects and Develops Control Activities," emphasizes that control activities, such as authorizations and verifications, are essential for mitigating risks. The framework's discussion on this principle explicitly includes segregation of duties as a common and critical type of control activity to prevent fraud and error. (See Principle 10, Page 81).

2. The Institute of Internal Auditors (IIA), Global Technology Audit Guide (GTAG) 8: Auditing Application Controls, 2nd Edition (2012). This guide states that strong controls over master file maintenance are crucial. It specifies that, "Changes to master files should be subject to the same authorization controls as the transactions that are processed against them... Segregation of duties should be enforced between those who can approve changes and those who can process them." (See Section: "Master File Controls," Page 14).

3. The Institute of Internal Auditors (IIA), International Professional Practices Framework (IPPF) (2017). Standard 2130.A1 requires internal auditors to evaluate the adequacy and effectiveness of controls. A key control for a payroll system is ensuring proper authorization for changes to pay rates, which is best achieved through segregation of duties as described in the correct answer.